Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/01/2023, 15:26

230111-st6fyahc2v 1

11/01/2023, 15:20

230111-sq37eadd28 1

11/01/2023, 15:14

230111-smrn7sdc95 3

11/01/2023, 15:12

230111-sk7yeadc88 1

11/01/2023, 15:03

230111-sfc78shb61 1

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2023, 15:12

General

  • Target

    https://github.com/LeandroCostaAnalistaTI/Ferramentas/blob/master/Planos/Ferramentas_UsandoRoot.sh

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/LeandroCostaAnalistaTI/Ferramentas/blob/master/Planos/Ferramentas_UsandoRoot.sh
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1856

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    03c43ce055f8989a6508481c8acb6608

    SHA1

    3dc33276158435396c4272531a62707a18a4a875

    SHA256

    1e977bad400e43c86966889b895bbf3b00b929b4bf497c791ad0ed2a0749fd3e

    SHA512

    fb69a674b2c2aa697a7c1fc94490298949831762d9d9612266314727ea85f84035df089f62e1aec24474caa1fc52fc94ea704d161335d37c1cf746c72af1f8ab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    85cc3578ed162feb565d73cd616bec3f

    SHA1

    819b12d9be08ebb8d2b5a59c1e7055c3dce8b48d

    SHA256

    5e035a3dd3b31fd023ca549497d93820a0551266e9177da361485521611e292e

    SHA512

    9ed0d81345605acd978f110d31ce29fbeda1db0dc3dae74da25d7e6cc84ba72583df715a835f3ecab517e2968bf0567457757ac62809f2883be36f3c5e5228ca

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\xyoggsx\imagestore.dat

    Filesize

    1KB

    MD5

    0d3e885315d93998525cc53cfcc387d3

    SHA1

    6a80a4c3a2a5c8dc9ae51d1a0a3c299fc64c0cb1

    SHA256

    b69cce3dd9dfc323db8b60e90651569e055cb1246a55b7f595064d5432516933

    SHA512

    30549dc7a801a8c0d3402d4d559b04afd98d4cb924009e51f6e832c1074691bf09ddcbb7a0cb6de322b8ca1fdc07f77ac0d581c90e5977b1b23c6f1b837e1ed5